ssti-server-side-template-injectionlisted

# SKILL: Server-Side Template Injection (SSTI) — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert SSTI techniques. Covers polyglot detection probes, engine fingerprinting, Jinja2/FreeMarker/Twig/ERB RCE chains, client-side Angular SSTI, and bypass techniques. Base models often miss sandbox escape MRO chains and non-Jinja2 engines. For PHP CMS template eval, Jira SSTI, Confluence OGNL, and Spring Cloud Gateway SpEL, load the companion [SCENARIOS.md](./SCENARIOS.md). ## 0. RELATED ROUTING Before using full engine-specific exploitation, you can first load: - First use the polyglot probe sequence at the top of this file for low-noise fingerprinting - [expression-language-injection](../expression-language-injection/SKILL.md) when `${7*7}` or `%{7*7}` resolves in Java (SpEL/OGNL) — different attack surface from template engines ### Extended Scenarios Also load [SCENARIOS.md](./SCENARIOS.md) when you need: - Maccms 8.x PHP template `eval` — `{if-A:phpinfo()}{endif-A}` in `vod-search`, base64 bypass for webshell write - Jira CVE-2019-11581 — "Contact Administrators" form → Velocity template injection → command output in admin email - Spring Cloud Gateway SpEL (CVE-2022-22947) — actuator route injection with `StreamUtils.copyToByteArray` for output capture - Struts2 OGNL S2-045 (CVE-2017-5638) — Content-Type header OGNL injection with `_memberAccess` / `OgnlUtil` blacklist clear - Confluence OGNL CVE-2021-26084 — `createpage-entervariables.action` with `\u0027` unicode b